@sap/cds 9.7.1 → 9.8.1

package/lib/srv/cds.Service.js

@@ -139,9 +139,9 @@ const compat_function_factory = (api, srv, it) => cds.utils.deprecated (ns => {
  */
 class Service extends ReflectionAPI {
 
-  /** 
-   * @param {string} name 
-   * @param {import('../core/linked-csn').LinkedCSN} model 
+  /**
+   * @param {string} name
+   * @param {import('../core/linked-csn').LinkedCSN} model
    */
   constructor (name, model, options) { super()
     if (typeof name === 'object') [ model, options, name = _service_in(model) ] = [ name, model ]
@@ -191,49 +191,21 @@ class Service extends ReflectionAPI {
     if (this._resolve) return this._resolve
 
     const { resolveView, getTransition } = require('../../libx/_runtime/common/utils/resolveView')
-    const PERSISTENCE_TABLE = '@cds.persistence.table'
-
-    const _isPersistenceTable = target =>
-      Object.prototype.hasOwnProperty.call(target, PERSISTENCE_TABLE) && target[PERSISTENCE_TABLE]
-    const _defaultAbort = tx => e => e._service?.name === tx.definition?.name
 
-    this._resolve = (query, abortCondition) => {
+    this._resolve = query => {
       const ctx = cds.context
       const model = ctx?.model || this.model
-      return resolveView(query, model, this, abortCondition || _defaultAbort(this))
+      return resolveView(query, model, this)
     }
 
-    // REVISIT: Remove argument `skipForbiddenViewCheck` once we get rid of composition tree
-    this._resolve.transitions = (query, abortCondition, skipForbiddenViewCheck) => {
+    // NOTE: used in lean-draft and odata stream middleware
+    this._resolve.transitions = query => {
       const target = query && typeof query === 'object' ? cds.infer.target(query) || query?._target : undefined
       const _tx = typeof tx === 'function' ? cds.context?.tx : this
       const event = query?.INSERT ? 'INSERT' : query?.UPDATE ? 'UPDATE' : query?.DELETE ? 'DELETE' : undefined
-      return getTransition(target, _tx, skipForbiddenViewCheck, event, {
-        abort: abortCondition ?? (this.isDatabaseService ? this.resolve._abortDB : _defaultAbort(this))
-      })
+      return getTransition(target, _tx, null, event)
     }
 
-    this._resolve.resolve4db = query => {
-      return this.resolve(query, this, this.resolve.abortDB)
-    }
-    
-    // REVISIT: Remove once we get rid of composition tree
-    this._resolve.table = target => {
-      if (target.query?._target && !_isPersistenceTable(target)) {
-        return this.resolve.table(target.query._target)
-      }
-      return target
-    }
-    
-    // REVISIT: Remove once we get rid of old db
-    this._resolve.abortDB = target => {
-      return !!(_isPersistenceTable(target) || !target.query?._target)
-    }
-    
-    this._resolve.transitions4db = (query, skipForbiddenViewCheck) => {
-      return this.resolve.transitions(query, this.resolve.abortDB, skipForbiddenViewCheck)
-    }
-    
     return this._resolve
   }
 }

package/lib/srv/protocols/hcql.js

@@ -1,5 +1,6 @@
 const cds = require('../../index'), {inspect} = cds.utils
 const express = require('express')
+const { pipeline } = require('node:stream/promises')
 
 const LOG = cds.log('hcql')
 const PROD = process.env.NODE_ENV === 'production'
@@ -69,7 +70,18 @@ class HCQLAdapter extends require('./http') {
    * The ultimate handler for all CRUD requests.
    */
   crud (req, res, next) {
-    let query = this.query4 (req)
+    let query = this.query4(req)
+
+    if (query.stream && can_stream(req))
+      return this.service
+        .tx(() =>
+          query.stream().then(results => {
+            res.set('content-type', 'application/octet-stream')
+            return pipeline(results, res)
+          })
+        )
+        .catch(next)
+
     return this.service.run (query)
     .then (results => this.reply (results, res))
     .catch (next)
@@ -81,7 +93,9 @@ class HCQLAdapter extends require('./http') {
    * which is expected to be a plain CQN object or a CQL string.
    */
   query4 (/** @type express.Request */ req) {
-    let q = req.body = cds.ql(req.body ?? {}) || this.error (400, 'Invalid query', { query: req.body })
+    let q = req.body = cds.ql(req.body ?? {})
+    if (!q.bind) this.error(400, 'Invalid query', { query: req.body })
+    q.bind(this.service)
     // handle request headers
     if (q.SELECT) {
       if (req.get('Accept-Language')) q.SELECT.localized = true
@@ -148,4 +162,7 @@ const ql_fragment = x => {
   }
   return x
 }
+const can_stream = req =>
+  req.headers.accept?.split?.(',').find(h => h.split(';')[0].trim() === 'application/octet-stream')
+
 module.exports = HCQLAdapter

package/lib/utils/cds-utils.js

@@ -1,10 +1,6 @@
 const cwd = process.env._original_cwd || process.cwd()
 const cds = require('../index')
 
-/* eslint no-empty: ["error", { "allowEmptyCatch": true }] */
-// eslint-disable-next-line no-unused-vars
-const _tarLib = () => { try { return require('tar') } catch(_) {} }
-
 exports = module.exports = new class {
   get colors() { return super.colors = require('./colors') }
   get inflect() { return super.inflect = require('./inflect') }
@@ -17,9 +13,19 @@ exports = module.exports = new class {
     const {format} = require('node:util')
     return super.format = format
   }
+  get yaml() {
+    const yaml = require('js-yaml')
+    return super.yaml = Object.assign(yaml,{parse:yaml.load})
+  }
+  get tar()  {
+    if (process.platform === 'win32') try { require.resolve('tar')
+      return super.tar = require('./tar-lib')
+    } catch {
+      return super.tar = require('./tar-win')
+    }
+    else return super.tar = require('./tar')
+  }
   get uuid() { return super.uuid = require('crypto').randomUUID }
-  get yaml() { const yaml = require('js-yaml'); return super.yaml = Object.assign(yaml,{parse:yaml.load}) }
-  get tar()  { return super.tar = process.platform === 'win32' && _tarLib() ? require('./tar-lib') : require('./tar') }
   get semver() { return super.semver = require('./version') }
 }
 
@@ -309,17 +315,20 @@ exports.csv = require('./csv-reader')
  * Loads a file through ESM or CommonJs.
  * @returns { Promise<any> }
  */
-// TODO find a better place.
-exports._import = id => {
-  try {
-    return require(id) // try CommonJS first
-  } catch (err) {
-    if (err.code !== 'ERR_REQUIRE_ESM')  throw err
-    // else try w/ ESM
-    const { pathToFileURL } = require('url')
-    return import (pathToFileURL(id).href) // must use a file: URL, esp. on Windows for C:\... paths
+exports._import = id => { // TODO find a better place.
+  if (id.endsWith('.mjs')) return _import (id)
+  if (id.endsWith('.cjs')) return require (id)
+  else try { return require(id) } catch (err) {
+    if (err.message === 'Cannot use import statement outside a module') return _import (id) // for jest
+    if (err.code === 'ERR_REQUIRE_ESM')  return _import (id)
+    else throw err
   }
 }
+const _import = process.platform === 'win32' ? (()=>{
+  const url = require('url') // On Windows we must use a file: URL, esp. for C:\... paths
+  return id => import (url.pathToFileURL(id).href)
+})() : id => import (id)
+
 
 const SECRETS = /(passw)|(cert)|(ca)|(secret)|(key)/i
 /**
@@ -349,7 +358,7 @@ exports.redacted = function _redacted(cred) {
 
 
 /**
- * A variant of child_process.exec that returns a promise, 
+ * A variant of child_process.exec that returns a promise,
  * which resolves with the command's stdout split into lines.
  * @example
  * await cds.utils.sh `npm ls -lp --depth=0`

package/lib/utils/tar-win.js

@@ -0,0 +1,106 @@
+// This module monkey patches ./tar.js to work on Windows, where tar does not work properly w/o these changes.
+
+exports = module.exports = require('./tar')
+
+exports._spawn_tar_c = (dir, args) => {
+  args.push('.')
+  if (Array.isArray(args[0])) return winSpawnTempDir(dir, args)
+  else return winSpawnDir(dir, args)
+}
+
+exports._path = path => {
+  if (!path) return path
+  if (typeof path === 'string') return path.replace('C:', '//localhost/c$').replace(/\\+/g, '/')
+  if (Array.isArray(path)) return path.map(el => exports._path(el))
+}
+
+
+const child_process = require('child_process')
+const spawn = /\btar\b/.test(process.env.DEBUG) ? (cmd, args, options) => {
+  Error.captureStackTrace(spawn,spawn)
+  process.stderr.write(cmd +' ', args.join(' ') +' '+ spawn.stack.slice(7) + '\n')
+  return child_process.spawn(cmd, args, options)
+} : child_process.spawn
+
+const cds = require('../index'), { fs, path, exists, rimraf } = cds.utils
+const { PassThrough } = require('stream')
+
+
+
+// spawn tar on Windows, using the cli version
+const winSpawnDir = (dir, args) => {
+  if (args.some(arg => arg === '-f')) return spawn ('tar', ['c', '-C', exports._path(dir), ...exports._path(args)])
+  else return spawn ('tar', ['cf', '-', '-C', exports._path(dir), ...exports._path(args)])
+}
+
+// copy a directory recursively on Windows, using fs.promises
+async function winCopyDir(src, dest) {
+  if ((await fs.promises.stat(src)).isDirectory()) {
+    const entries = await fs.promises.readdir(src)
+    return Promise.all(entries.map(async each => winCopyDir(path.join(src, each), path.join(dest, each))))
+  } else {
+    await fs.promises.mkdir(path.dirname(dest), { recursive: true })
+    return fs.promises.copyFile(src, dest)
+  }
+}
+
+// copy resources containing files and folders to temp dir on Windows 
+// cli tar has a size limit on Windows
+const winCreateTemp = async (root, resources) => {
+  // Asynchronously copies the entire content from src to dest.
+  const temp = await fs.promises.mkdtemp(`${fs.realpathSync(require('os').tmpdir())}${path.sep}tar-`)
+  for (let resource of resources) {
+    const destination = path.join(temp, path.relative(root, resource))
+    if ((await fs.promises.stat(resource)).isFile()) {
+      const dirName = path.dirname(destination)
+      if (!await exists(dirName)) {
+        await fs.promises.mkdir(dirName, { recursive: true })
+      }
+      await fs.promises.copyFile(resource, destination)
+    } else {
+      if (fs.promises.cp) {
+        await fs.promises.cp(resource, destination, { recursive: true })
+      } else {
+        // node < 16
+        await winCopyDir(resource, destination)
+      }
+    }
+  }
+
+  return temp
+}
+
+// spawn tar on Windows, using a temp dir, which is copied from the original dir
+// cli tar has a size limit on Windows
+const winSpawnTempDir = (dir, args) => {
+  // Synchronous trick: use a PassThrough as placeholder
+  const stdout = new PassThrough()
+  const stderr = new PassThrough()
+  const c = {
+    stdout,
+    stderr,
+    on: (...a) => { stdout.on(...a); stderr.on(...a); return c },
+    once: (...a) => { stdout.once(...a); stderr.once(...a); return c },
+    kill: () => {},
+  }
+  
+  // async copy, then swap streams/events
+  winCreateTemp(dir, args.shift()).then(tempPath => {
+    const real = winSpawnDir(tempPath, args)
+    real.stdout.pipe(stdout)
+    real.stderr && real.stderr.pipe(stderr)
+    const cleanup = () => exists(tempPath) && rimraf(tempPath)
+    real.on('close', (...ev) => { 
+      stdout.emit('close', ...ev)
+      stderr.emit('close', ...ev)
+      cleanup()
+    })
+    real.on('error', (...ev) => { 
+      stdout.emit('error', ...ev)
+      stderr.emit('error', ...ev) 
+      cleanup()
+    })
+    c.kill = (...ev) => real.kill(...ev)
+  })
+  return c
+}

package/lib/utils/tar.js

@@ -1,4 +1,3 @@
-const { PassThrough } = require('stream')
 const child_process = require('child_process')
 const spawn = /\btar\b/.test(process.env.DEBUG) ? (cmd, args, options) => {
   Error.captureStackTrace(spawn,spawn)
@@ -6,137 +5,9 @@ const spawn = /\btar\b/.test(process.env.DEBUG) ? (cmd, args, options) => {
   return child_process.spawn(cmd, args, options)
 } : child_process.spawn
 
-const cds = require('../index'), { fs, path, mkdirp, exists, rimraf } = cds.utils
+const cds = require('../index'), { fs, path, mkdirp } = cds.utils
 const _resolve = (...x) => path.resolve (cds.root,...x)
 
-// ======= ONLY_FOR_WINDOWS ======
-// This section contains logic relevant for Windows OS.
-
-// tar does not work properly on Windows w/o this change
-const win = path => {
-  if (!path) return path
-  if (typeof path === 'string') return path.replace('C:', '//localhost/c$').replace(/\\+/g, '/')
-  if (Array.isArray(path)) return path.map(el => win(el))
-}
-
-// spawn tar on Windows, using the cli version
-const winSpawnDir = (dir, args) => {
-  if (args.some(arg => arg === '-f')) return spawn ('tar', ['c', '-C', win(dir), ...win(args)])
-  else return spawn ('tar', ['cf', '-', '-C', win(dir), ...win(args)])
-}
-
-// copy a directory recursively on Windows, using fs.promises
-async function winCopyDir(src, dest) {
-  if ((await fs.promises.stat(src)).isDirectory()) {
-    const entries = await fs.promises.readdir(src)
-    return Promise.all(entries.map(async each => winCopyDir(path.join(src, each), path.join(dest, each))))
-  } else {
-    await fs.promises.mkdir(path.dirname(dest), { recursive: true })
-    return fs.promises.copyFile(src, dest)
-  }
-}
-
-// copy resources containing files and folders to temp dir on Windows 
-// cli tar has a size limit on Windows
-const winCreateTemp = async (root, resources) => {
-  // Asynchronously copies the entire content from src to dest.
-  const temp = await fs.promises.mkdtemp(`${fs.realpathSync(require('os').tmpdir())}${path.sep}tar-`)
-  for (let resource of resources) {
-    const destination = path.join(temp, path.relative(root, resource))
-    if ((await fs.promises.stat(resource)).isFile()) {
-      const dirName = path.dirname(destination)
-      if (!await exists(dirName)) {
-        await fs.promises.mkdir(dirName, { recursive: true })
-      }
-      await fs.promises.copyFile(resource, destination)
-    } else {
-      if (fs.promises.cp) {
-        await fs.promises.cp(resource, destination, { recursive: true })
-      } else {
-        // node < 16
-        await winCopyDir(resource, destination)
-      }
-    }
-  }
-
-  return temp
-}
-
-// spawn tar on Windows, using a temp dir, which is copied from the original dir
-// cli tar has a size limit on Windows
-const winSpawnTempDir = (dir, args) => {
-  // Synchronous trick: use a PassThrough as placeholder
-  const stdout = new PassThrough()
-  const stderr = new PassThrough()
-  const c = {
-    stdout,
-    stderr,
-    on: (...a) => { stdout.on(...a); stderr.on(...a); return c },
-    once: (...a) => { stdout.once(...a); stderr.once(...a); return c },
-    kill: () => {},
-  }
-  
-  // async copy, then swap streams/events
-  winCreateTemp(dir, args.shift()).then(tempPath => {
-    const real = winSpawnDir(tempPath, args)
-    real.stdout.pipe(stdout)
-    real.stderr && real.stderr.pipe(stderr)
-    const cleanup = () => exists(tempPath) && rimraf(tempPath)
-    real.on('close', (...ev) => { 
-      stdout.emit('close', ...ev)
-      stderr.emit('close', ...ev)
-      cleanup()
-    })
-    real.on('error', (...ev) => { 
-      stdout.emit('error', ...ev)
-      stderr.emit('error', ...ev) 
-      cleanup()
-    })
-    c.kill = (...ev) => real.kill(...ev)
-  })
-  return c
-}
-
-// ====== END ONLY_FOR_WINDOWS ======
-
-const tarInfo = async (info) => {
-  let cmd, param
-  if (info === 'version') {
-    cmd = 'tar'
-    param = ['--version']
-  } else {
-    cmd = process.platform === 'win32' ? 'where' : 'which'
-    param = ['tar']
-  }
-
-  const c = spawn (cmd, param)
-
-  return {__proto__:c,
-    then (resolve, reject) {
-      let data=[], stderr=''
-      c.stdout.on('data', d => {
-        data.push(d)
-      })
-      c.stderr.on('data', d => stderr += d)
-      c.on('close', code => {
-        code ? reject(new Error(stderr)) : resolve(Buffer.concat(data).toString().replace(/\n/g,'').replace(/\r/g,''))
-      })
-      c.on('error', reject)
-    }
-  }
-}
-
-const logDebugTar = async () => {
-  const LOG = cds.log('tar')
-  if (!LOG?._debug) return
-  try {
-    LOG (`tar path: ${await tarInfo('path')}`)
-    LOG (`tar version: ${await tarInfo('version')}`)
-  } catch (err) {
-    LOG('tar error', err)
-  }
-}
-
 /**
  * Creates a tar archive, to an in-memory Buffer, or piped to write stream or file.
  * @example ```js
@@ -162,26 +33,12 @@ const logDebugTar = async () => {
  * - `.to()` is a convenient shortcut to pipe the output into a write stream
  */
 exports.create = (dir='.', ...args) => {
-  logDebugTar()
+
   if (typeof dir === 'string') dir = _resolve(dir)
   if (Array.isArray(dir)) [ dir, ...args ] = [ cds.root, dir, ...args ]
-
-  let c
   args = args.filter(el => el)
-  if (process.platform === 'win32') {    
-    args.push('.')
-    if (Array.isArray(args[0])) c = winSpawnTempDir(dir, args)
-    else c = winSpawnDir(dir, args)
-  } else {
-    if (Array.isArray(args[0])) {
-      args.push (...args.shift().map (f => path.isAbsolute(f) ? path.relative(dir,f) : f))
-    } else {
-      args.push('.')
-    }
-
-    c = spawn ('tar', ['c', '-C', dir, ...args], { env: { COPYFILE_DISABLE: 1 }})
-  }
 
+  const c = exports._spawn_tar_c (dir, args)
   return {__proto__:c, // returning a thenable + fluent ChildProcess...
 
     /**
@@ -219,6 +76,22 @@ exports.create = (dir='.', ...args) => {
   }
 }
 
+
+// Extracted to allow os-specific implementations, e.g. for win32
+exports._spawn_tar_c = (dir, args) => {
+  if (Array.isArray(args[0])) {
+    args.push (...args.shift().map (f => path.isAbsolute(f) ? path.relative(dir,f) : f))
+  } else {
+    args.push ('.')
+  }
+  return spawn ('tar', ['c', '-C', dir, ...args], { env: { COPYFILE_DISABLE: 1 }})
+}
+
+
+// Extracted to allow os-specific implementations, e.g. for win32
+exports._path = p => p
+
+
 /**
  * Extracts a tar archive, from an in-memory Buffer, or piped from a read stream or file.
  * @example ```js
@@ -242,7 +115,7 @@ exports.extract = (archive, ...args) => ({
   to (...dest) {
     if (typeof dest === 'string') dest = _resolve(...dest)
     const input = typeof archive !== 'string' || archive == '-' ? '-' : _resolve(archive)
-    const x = spawn('tar', ['xf', win(input), '-C', win(dest), ...args])
+    const x = spawn('tar', ['xf', exports._path(input), '-C', exports._path(dest), ...args])
     if (archive === '-') return x.stdin
     if (Buffer.isBuffer(archive)) archive = require('stream').Readable.from (archive)
     if (typeof archive !== 'string') (archive.stdout || archive) .pipe (x.stdin)
@@ -251,8 +124,8 @@ exports.extract = (archive, ...args) => ({
     x.stderr.on ('data', d => stderr += d)
     return {__proto__:x,
       then (resolve, reject) {
-        x.on('close', code => {
-          if (code) return reject (new Error(stderr))
+        x.on('close', err => {
+          if (err) return reject (new Error(stderr))
           if (process.platform === 'linux') stdout = stderr
           resolve (stdout ? stdout.split('\n').slice(0,-1).map(x => x.replace(/^x |\r/g,'')): undefined)
         })
@@ -304,12 +177,4 @@ exports.t = tar.tf = tar.list
  * @example fs.createReadStream('t.tar') .pipe (tar.x.to('dest/dir'))
  * @returns `stdin` of the tar child process
  */
- exports.extract.to = function (..._) { return this('-').to(..._) }
-
-
-
-// ---------------------------------------------------------------------------------
-// Compatibility...
-
-exports.packTarArchive = (resources,d) => d ? tar.cz (d,resources) : tar.cz (resources)
-exports.unpackTarArchive = (x,dir) => tar.xz(x).to(dir)
+exports.extract.to = function (..._) { return this('-').to(..._) }

package/libx/_runtime/common/generic/crud.js

@@ -11,19 +11,19 @@ module.exports = cds.service.impl(function () {
   this.on(['CREATE', 'READ', 'UPDATE', 'UPSERT', 'DELETE'], '*', async function handle_crud_requests(req) {
 
     if (!cds.db)
-      return req.reject ('NO_DATABASE_CONNECTION') // REVISIT: error message
+      return req.reject('NO_DATABASE_CONNECTION') // REVISIT: error message
 
     if (!req.query)
-      return req.reject (501, 'The request has no query and cannot be served generically.')
+      return req.reject(501, 'The request has no query and cannot be served generically.')
 
     if (typeof req.query !== 'string' && req.target?._hasPersistenceSkip)
-      return req.reject (501, `Entity "${req.target.name}" is annotated with "@cds.persistence.skip" and cannot be served generically.`)
+      return req.reject(501, `Entity "${req.target.name}" is annotated with "@cds.persistence.skip" and cannot be served generically.`)
 
     // validate that all elements in path exist on db, if necessary
     // - INSERT has no where clause to do this in one roundtrip
     // - SELECT returns [] -> really empty collection or invalid path?
     const subject = req.query.INSERT?.into || req.query.SELECT?.from
-    const pathExistsQuery = subject?.ref?.length > 1 && SELECT(1).from({ ref: subject.ref.slice(0,-1) })
+    const pathExistsQuery = subject?.ref?.length > 1 && SELECT(1).from({ ref: subject.ref.slice(0, -1) })
 
     if (req.event === 'CREATE' && pathExistsQuery) {
       // REVISIT: Why dont't we just run the insert and check affected rows?
@@ -33,10 +33,10 @@ module.exports = cds.service.impl(function () {
 
     if (req.event in { DELETE: 1, UPDATE: 1 } && req.target?._isSingleton) {
       if (req.event === 'DELETE' && !req.target['@odata.singleton.nullable'])
-        return req.reject (400, 'SINGLETON_NOT_NULLABLE')
+        return req.reject(400, 'SINGLETON_NOT_NULLABLE')
 
       const selectSingleton = SELECT.one(req.target)
-      const keyColumns = [...(req.target.keys||[])].filter(e => !e.isAssociation).map(e => e.name)
+      const keyColumns = [...(req.target.keys || [])].filter(e => !e.isAssociation).map(e => e.name)
 
       // if no keys available, select all columns so we can delete the singleton with same content
       if (keyColumns.length) selectSingleton.columns(keyColumns)
@@ -54,7 +54,8 @@ module.exports = cds.service.impl(function () {
 
     if (req.event === 'READ' && req.query?.SELECT && req.locale) req.query.SELECT.localized ??= true
 
-    const result = await cds.run (req.query, req.data)
+    // REVISIT for cds^10: can we always use cds.db.dispatch(req)?
+    const result = req.iterator && !req.objectMode ? await cds.db.dispatch(req) : await cds.run(req.query, req.data)
 
     if (req.event === 'READ') {
       // do not execute additional select to distinguish between 412 and 404

package/libx/_runtime/common/generic/sorting.js

@@ -50,6 +50,12 @@ const _addDefaultSortOrder = (req, select) => {
   )
 }
 
+const containsAggregation = column => {
+  if (column.func) return true
+  if (column.xpr) return column.xpr.some(xpr => containsAggregation(xpr))
+  return false
+}
+
 /**
  * 1. query options --> already set in req.query
  * 2. orders from view
@@ -63,9 +69,7 @@ const handle_sorting = function (req) {
   let select = req.query.SELECT
 
   // do not sort for /$count queries or queries only using aggregations
-  if (select.columns && select.columns.length && select.columns.every(col => col.func)) {
-    return
-  }
+  if (select.columns?.length && select.columns.every(col => containsAggregation(col))) return
 
   if (select.from && select.from.SELECT) {
     // add default sort to root query